question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cookies aren't sent if secure flag set previously

See original GitHub issue

I’m coming from this question: https://github.com/expressjs/cookie-session/issues/89, except that I use HTTPS when using production environment and HTTP when using development. Each time I test the application in production, the secure cookies are set, and when I try to test it again in development, the cookies are not sent (even though I tried to specifically set the secure flag as secure: process.env.NODE_ENV === 'production'). I don’t want to set the secure flag to false on production, as I only need secure cookies there. Is there a way to get the cookies to be sent when using HTTP?

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:7 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
geiszlacommented, Oct 9, 2018

Okay, I just figured it out: if I use different names for the cookies depending on the environment, it will work on both HTTPS and HTTP.

0reactions
geiszlacommented, Oct 9, 2018

Would it be possible to use different session cookies when using HTTP, so that it doesn’t try to get the secured ones?

Read more comments on GitHub >

github_iconTop Results From Across the Web

TLS cookie without secure flag set
If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within...
Read more >
Is it imporant that a cookie should have secure flag set if ...
The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS.
Read more >
Secure Cookie Attribute
The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie...
Read more >
Cookie Security Flags | Learn AppSec
The Secure flag specifies that the cookie may only be transmitted using HTTPS connections (SSL/TLS encryption) and never sent in clear text. If...
Read more >
Cookie lack Secure flag - Knowledge Base - Detectify
When a cookie does not have the Secure-flag set, it will be sent in every request over both HTTP and HTTPS. Even if...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found